Data Processing Agreement

This Data Processing Agreement was last revised on, and effective as of, May 9, 2024.

This Data Processing Addendum (“DPA“) supplements the ScreenPal Terms of Service (“TOS”) found here and entered into between Big Nerd Software, LLC dba ScreenPal (“ScreenPal“) and you (the “Customer”) in relation to the transfer and Processing of Customer Personal Data in connection with the provision of the Services.

Definitions

All capitalized terms not defined in this DPA shall have the meanings set forth in the Agreement and the following capitalized terms used inthis DPA will be defined as follows:

“Adequate Jurisdiction” means the UK, EEA, Switzerland or a country or territory deemed to provide adequate protection for the rights and freedoms of individuals, as set out in:

·       the Data Protection Act 2018 or regulations made by the UK Secretary of State under the Data Protection Act 2018;

·       a decision of the European Commission; or

·       a decision of the Swiss Federal Council as listed in Annex 1 to the Ordinance (as amended from time to time).

“Administration Data” means

·       contact details relating to, and the content of correspondence with the Customer’s main account holder or administrator; and

·       support enquiries submitted by the Customer’s authorized users in relation to the Services.

“Agreement” means the agreement between Customer and ScreenPal in relation to the provision of the Services, comprising the terms of service at https://screenpal.com/tos or as otherwise agreed between the parties.

“Authorized Subprocessors” means the Subprocessors listed at https://ScreenPal.com/privacy/subprocessors, as amended from time to time in accordance with the section headed “Subprocessing” below.

“EEA” means the member states of the European Union and Iceland, Liechtenstein, Norway.

“Effective Date” means the later of: (a) the date the Customer enters into the Agreement; and (b) the date first written above.

“GDPR” means Regulation (EU) 2016/679 (the “EU GDPR“) or, where applicable, the “UK GDPR” as defined in section 3 of the Data Protection Act 2018.

“Controller” shall mean the entity which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data.

“Controller Purposes” means: (i) monitoring the performance the Services, and identifying and repairing errors that impair existing functionality of the Services; (ii) facilitating the security and integrity of the Services, including the detection and prevention of fraud, business continuity and disaster recovery; (iii) undertaking internal research and development to develop, test, improve and alter the functionality of ScreenPal’s products and services; and (iv) administering ScreenPal’s relationship with the Customer under the Agreement, including invoicing and maintaining transaction records for accounting and tax reporting purposes.

“Customer Personal Data” means the Personal Data that ScreenPal Processes on behalf of the Customer in connection with the Services, as more particularly described in Annex 1.

“Data Subject” means a natural person to whom Personal Data relates.

“DPF” means the “DPF”, “EU-US Data Privacy Framework” or (where applicable) the “UK Extension to the EU-US Data Privacy Framework” and the “Swiss-US Data Privacy Framework”, in each case as defined in the relevant US Adequacy Decision.

“DPF List” means the “Data Privacy Framework List”, “DPF List” or equivalent term as defined in the applicable US Adequacy Decision.

“DPF Principles” means the “EU-US Data Privacy Framework Principles” or “Principles” as defined in the applicable US Adequacy Decision.

“European Data Protection Laws” means all applicable laws, rules, regulations and governmental requirements in the EEA, UK and Switzerland relating to the privacy, confidentiality, or security of Personal Data, as they may be amended or otherwise updated from time to time, including (without limitation) the GDPR and Swiss Data Protection Laws.

“Processor” shall mean an entity which Processes Personal Data on behalf of a Controller.

“Personal Data” means any information that: (a) relates to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, and identification number, location data or online identifier; or (b) is otherwise “personal data” or “personal information” under the European Data Protection Laws.

“Processing” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means. “Process”, “Processes” and “Processed” will be interpreted accordingly.

“Special Categories of Data” means the categories of Personal Data set out in Article 9(1) of the GDPR or, where applicable, “sensitive personal data” as defined in Article 5 of the FADP.

“Standard Contractual Clauses” or “SCCs” means the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) EU 2021 / 914.

“Subprocessor” means a Processor engaged by another Processor to Process Personal Data.

“Swiss Data Protection Laws” means the Swiss Federal Act on Data Protection of 25 September 2020 (“FADP“) and the Swiss Data Protection Ordinance of 31 August 2022 (the “Ordinance“), and any new or revised version of these laws that may enter into force for time to time.

“UK” means the United Kingdom.

“US Adequacy Decisions” means: (a) the UK Data Protection (Adequacy) (United States of America) Regulations 2023; (b) Commission Implementing Decision C(2023) 4745 on the adequate level of protection of personal data under the EU-US Data Privacy Framework; and (c) a decision of the Swiss Federal Council with similar effect to (a) and (b) in respect of the Swiss-US Data Privacy Framework.

“Usage Data” means diagnostic, usage and performance information collected by ScreenPal in relation to the Customer’s and its authorized users’ use of the Services.

Applicability of DPA 

Applicability. This DPA applies, is incorporated into and forms an integral part of the Agreement to the extent that: (i) European Data Protection Laws apply to the Customer’s Processing of Customer Personal Data; or (ii) the transfer of Customer Personal Data by Customer to ScreenPal is an “onward transfer” as defined in the Standard Contractual Clauses.

Roles and responsibilities 

Roles of the Parties. The parties acknowledge that, as between ScreenPal and Customer, for the purposes of the European Data Protection Laws:

·       other than in respect of ScreenPal’s Processing of Usage Data and Administration Data for the Controller Purposes, Customer acts as the Controller and ScreenPal acts as the Processor;

·       ScreenPal acts as a Controller with respect to the Processing of Usage Data and Administration Data for the Controller Purposes;

Customer Processing of Customer Personal Data. Customer shall be responsible for:

·       complying with European Data Protection Laws in respect of its use of the ScreenPal Service, its Processing of the Customer Personal Data, and any Processing instructions it issues to ScreenPal;

·       ensuring it has, and will continue to have, the right to transfer, or provide access to, the Customer Personal Data to ScreenPal for Processing pursuant to the Agreement and this DPA; and

·       ensuring that it shall not disclose (nor permit any data subject to disclose) any Special Categories of Data to ScreenPal for Processing.

ScreenPal’s Processing of Customer Personal Data. Other than in respect of its Processing of Usage Data and Administration Data for the Controller Purposes:

ScreenPal shall Process the Customer Personal Data for the purposes described in the Agreement and this DPA and in accordance with the lawful, documented instructions of Customer (including the instructions of any users accessing the Services on Customer’s behalf as set out in the Agreement); and ScreenPal may Process Customer Personal Data to the extent required under applicable law in effect in the EEA, UK or Switzerland, in which case ScreenPal shall notify the Customer of that requirement unless prohibited by such applicable law on important grounds of public interest.

Security 

Security. ScreenPal shall implement appropriate technical and organizational measures to protect Customer Personal Data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access (each a “Security Incident“). Without limiting the generality of the foregoing, ScreenPal shall put in place and maintain the technical and organizational measures a set out in Annex 2 of this DPA.

Confidentiality of Processing. ScreenPal shall ensure that any person that it authorizes to Process the Customer Personal Data shall be subject to a duty of confidentiality (whether a contractual or a statutory duty).

Security Incidents. Upon becoming aware of a Security Incident, ScreenPal shall notify Customer without undue delay and shall provide such timely information as Customer may reasonably require, including to enable Customer to fulfil any data breach reporting obligations under the European Data Protection Laws. ScreenPal shall promptly take appropriate and commercially reasonable steps to mitigate the effects of such a Security Incident, to the extent such efforts are within ScreenPal’s reasonable control. ScreenPal’s notification of or response to a Security Incident shall not be construed as an acknowledgement by ScreenPal of any fault or liability with respect to the Security Incident.

Subprocessing

Subprocessors. Customer grants ScreenPal general authorization to engage the Authorised Subprocessors to Process Customer Personal Data on ScreenPal’s behalf, provided that:

• ScreenPal shall impose on such Subprocessors data protection terms that protect Customer Personal Data to the substantially similar standard provided for by this DPA; and
• ScreenPal shall remain liable for any breach of the DPA caused by an Authorized Subprocessor.

Changes to Subprocessors. ScreenPal shall notify Customer of any proposed changes to the Authorized Subprocessors by updating the list at https://ScreenPal.com/privacy/subprocessors at least thirty (30) days prior to any such change. Customer may object to a new Subprocessor on reasonable grounds relating to the protection of the Customer Personal Data at any time prior to the change coming into effect. In such an event, the parties shall cooperate in good faith to reach a resolution and if such resolution cannot be reached, then, ScreenPal, at its discretion, will either: (i) not appoint or replace the Subprocessor; or (ii) will permit Customer to suspend or terminate the Agreement on thirty (30) days written notice (without prejudice to any fees incurred by Customer prior to suspension or termination).

International transfers

Onward transfers. ScreenPal shall not transfer any Customer Personal Data to a recipient outside the UK, EEA or Switzerland unless:

·       the recipient is in an Adequate Jurisdiction; or

·       ScreenPal complies with the requirements of the DPF when making such transfer, including taking reasonable and appropriate steps to ensure that the recipient provides the same level of protection as the DPF Principles and notifies ScreenPal if it makes a determination that it can no longer meet this obligation; or

·       the transfer is otherwise not prohibited under the European Data Protection Laws.

Transfers subject to the SCCs. To the extent that: (i) ScreenPal ceases to be listed as a participating organization in the applicable DPF List for the purposes of a US Adequacy Decision; or (ii) a US Adequacy Decision is repealed, withdrawn or otherwise does not apply to transfers of Customer Personal Data from Customer (as data exporter) to ScreenPal (as data importer), the parties agree that:

·       the SCCs, as further set out in Annex 3, shall apply to such transfers and be deemed incorporated in this DPA;

·       signature of this DPA shall have the same effect as signing the SCCs; and

·       in the event of a conflict between any of the provisions of the SCCs and the remainder of this DPA, the provisions of the SCCs shall prevail.

Cooperation

Cooperation and data subjects’ rights. ScreenPal shall, taking into account the nature of the Processing, assist the Customer by appropriate technical and organizational measures, insofar as this is possible, to enable Customer to respond to requests from a Data Subject seeking to exercise their rights under the European Data Protection Laws.

Data Protection Impact Assessments. ScreenPal shall, to the extent required by European Data Protection Laws, provide Customer with commercially reasonable assistance needed to fulfil Customer’s obligation to carry out with data protection impact assessments or prior consultations with supervisory authorities, to the extent Customer does not otherwise have access to the relevant information. ScreenPal shall be entitled to claim for reasonable expenses incurred by ScreenPal as a result of providing such assistance to the Customer.

Disclosure to authorities. Customer acknowledges that ScreenPal may disclose the privacy provisions in this DPA and the Agreement to the US Department of Commerce, the Federal Trade Commission, a data protection authority in the EEA, UK or Switzerland, or any other applicable judicial or regulatory body upon their lawful request. ScreenPal shall use reasonable efforts to notify Customer of any request for disclosure of Customer Personal Data by a governmental or regulatory body or law enforcement authority unless otherwise prohibited by law or legally binding order of such body or agency.

Security reports and audits

Documentation. ScreenPal shall provide, upon Customer’s reasonable request, all information reasonably necessary to demonstrate ScreenPal’s compliance with this DPA.

Audits. ScreenPal shall permit the Customer (or its appointed third-party auditors) to carry out an audit of ScreenPal’s Processing of Customer Personal Data under the Agreement, provided that:

·       such audits are conducted not more than once per year, unless more frequent audits are required by the Customer’s supervisory authority;

·       Customer must give ScreenPal reasonable prior notice of such intention to audit, conduct its audit during normal business hours, and take all reasonable measures to prevent unnecessary disruption to ScreenPal’s operations;

·       the parties agree on the scope of the audit in advance; and

·       Customer shall be responsible for all costs incurred in connection with any such audits (including any reasonable costs incurred by ScreenPal in facilitating such audit) unless such audit is required as a direct result of ScreenPal’s breach of its obligations under this DPA and the Agreement.

Certifications and self-audits. ScreenPal may, in response to the Customer’s audit request:

·       provide the Customer with any independent audit reports or data protection compliance certifications issued by a commonly accepted certification provider and obtained by ScreenPal in support of ScreenPal’s obligations under this DPA; or

·       arrange for a qualified and independent auditor to conduct an audit of ScreenPal’s policies and technical and organizational measures in support of the obligations under this DPA using an appropriate and accepted control standard or framework and provide the report of such audit to Customer, and Customer agrees to accept any such audit reports or certifications provided by ScreenPal in place of conducting an audit.

Deletion / return of data

Term. This DPA shall commence on the Effective Date and, notwithstanding termination or expiry of the Agreement, will remain in effect until and automatically expire on ScreenPal’s deletion or anonymization of all Customer Personal Data.

Deletion or return of data: ScreenPal shall:

·       if requested to do so by Customer within sixty (60) days of termination or expiry of the Agreement (the “Termination Retention Period“) provide Customer a copy of all Customer Personal Data Processed by ScreenPal as a Processor in such commonly used format as requested by Customer, or provide a self service functionality allowing Customer to download such Customer Personal Data; and

·       on expiry of the Termination Retention Period, delete all copies of Customer Personal Data Processed by ScreenPal other than: (i) Customer Personal Data that ScreenPal is required to retain by applicable law or that is archived on backup systems (provided such Customer Personal Data is deleted as soon as reasonably practicable or permitted under applicable law); (ii) Administration Data and Usage Data Processed by ScreenPal for the Controller Purposes.

Miscellaneous

Except as amended by this DPA, the Agreement will remain in full force and effect.

Any claim brought under this DPA shall be subject to the Agreement, including but not limited to the exclusions and limitations of liability set forth in the Agreement. If there is a conflict between the Agreement and this DPA, the terms of this DPA will control.

This DPA shall be governed by the same law as the Agreement.

ANNEX 1 – DETAILS OF THE PROCESSING OF CUSTOMER PERSONAL DATA

A. List of Parties

	Customer	ScreenPal
Role	Data exporter (controller)	Data importer (Processor)
Contact person	The administrator of the Customer’s account as notified to ScreenPal	support@screenpal.com
Activities relevant to the transfer	The receipt of the Services under the Agreement.	The performance of the Services under the Agreement.

B. Description of Processing

Categories of Data Subjects	·        Employees, agents or other individuals authorized by the Customer to access and use the Services pursuant to the terms of the Agreement (“Authorized Users“) ·        Any other individuals featured in any Content uploaded by Customer and its Authorized Users to the Services (“Content Subjects“) ·        Individuals that view and interact with content uploaded to the Services by Authorized Users (“Content Viewers“)
Categories of Personal Data	Authorized Users ·        Name, email address, role at Customer; ·        Content uploaded to the Services (videos, images, comments, quiz answers); ·        Statistics relating to the performance of and interactions with content uploaded to the Services by the Authorized User (such as number of views); ·        Usage data relating to use of the Services, including IP address; and ·        Support request and communications sent to ScreenPal. Content Subjects ·        Information contained in content uploaded by Authorized Users to the Services Content Viewers ·        Information relating to the Content Viewer’s interaction with content uploaded by Authorized Users (date and time viewed, number of times viewed, comments in relation to the content, responses to questions and quizzes).
Special categories of Personal Data	None
Frequency of the transfer	Continuous
Nature of the Processing	Collection, storage, deletion, rectification, analysis and aggregation
Purposes of the data transfer and further Processing	The delivery of the Services, including: ·        Hosting and distribution of content created and/or uploaded by Authorized Users; ·        Provision of analytics and audience information relating to content created and/or uploaded by Authorized Users; ·        Resolving queries and support requests submitted by the Customer and its Authorized Users.
Retention period	For the duration of the Agreement, unless earlier deletion is requested or communicated by the Customer.
Subprocessors	As set out at https://ScreenPal.com/privacy/subprocessors

 

ANNEX 2

Technical and Organizational Security Measures

NIST

ScreenPal follows the NIST Security Framework.

ScreenPal has committed management and dedicated staff to the  design, implementation and operation of  its information security program.

Access Control

Access Management Policy to control ScreenPal system components (i.e. cloud servers, applications, databases, etc.) and sensitive information (e.g. Personal Data) in the organization, including the framework and the principles for user provisioning.  Role-based access controls allowing staff access to systems and data only on a need-to-know basis.

Segregation of duties and prior approval of all user accounts by ScreenPal based on data classification with ongoing review of user access permissions.

Awareness and Training

Mandatory training related to data privacy and security requirements for all employees responsible in whole or in part for design, production, development, operations and marketing of ScreenPal products. Such training will include all employees who are directly or peripherally involved in collection, use, storage, disclosure or any other handling of data.

Audit and Accountability

Includes policies, controls, and operational practices for proper auditing and accountability.  ScreenPal continuously monitors its environment and centralizes its logs. Anomalies are investigated and prioritized on a continual basis.

Assessment, Authorization, and Monitoring

Auditing and assurance programs for all security and privacy policies conducted on a minimum annual review with quarterly security review meetings that include review of past audits.  Ongoing vulnerability testing and annual penetration testing with managed mitigation.

Configuration Management

Policies, processes, and controls for configuration management including application development policy, change control process, data encryption and key management policy, asset handling procedures including cataloging and tracking of all physical and logical assets, and risk assessment methodology.

Contingency Planning

Formal business continuity and disaster recovery plan that includes data access and storage,  continuity of use, and capacity management.  Daily backups and service replication with continuous monitoring.

Identification and Authentication

Policies and operational procedures for appropriate identification and authentication to include unique employee identity, single-sign-on and MFA controls based on system access, formal password policies, and secure storage of credentials.   Ongoing reviews of employee access and associated controls.

Incident Response

Incident Response Management Plan to bring needed resources together in an organized manner to deal with an adverse event related to the safety and security of ScreenPal’s Business & Information Assets, including a malicious code attack, unauthorized access to organizational systems, unauthorized utilization of organization services in denial of service attacks, general misuse of systems, or hoaxes.

Maintenance

Formal and operational procedures for continuous monitoring of infrastructure and software, including third party monitoring.

Media Protection

Policies, controls and operational procedures for the protection of customer data stored on media, including industry standard encryption at rest.   Use of trusted third party services (eg AWS) for storage and security services.

Physical and Environmental Protection

ScreenPal is a virtual company and customer data is maintained with ScreenPal sub-processors with the main cloud infrastructure on AWS.   AWS has strict policies for physical access to any equipment or systems that store ScreenPal customer data and industry-recognized certifications and audits: PCI DSS Level 1, ISO 27001, FISMA Moderate, FedRAMP, HIPAA, and SOC 1 (formerly referred to as SAS 70 and/or SSAE 16) and SOC 2 audit reports. Their services and data centers have multiple layers of operational and physical security.

Planning

Policies and operational procedures including formally documented quarterly security and access reviews, monitoring of regulatory compliance, and audits/updates to formal security documentation.

Program Management

Dedicated security staff to maintain and update the ScreenPal security program, including policies, controls and operational procedures.  Including risk assessment, formal documentation, monitoring mitigation and training with appropriate executive management approvals.

Personnel Security

Formal policies, controls and operational procedures which include appropriate background checks for all employees, onboarding including confidentiality and acknowledgement of policies, annual training, offboarding checklists that address removal of access.

Risk Assessment

Annual risk assessment process identifying major strategic developments in the industry, emerging threats, & vulnerabilities, to ScreenPal business and IT assets, and report results in a formal risk assessment document.

Standard Risk assessment methodologies include but are not limited to NIST SP 800-30.

System and Services Acquisition

Formal software development policy, change management process, and patch management policy with test automation and peer review.   Agile development methodology includes rapid response to critical incidents and associated escalation processes.  Monitoring and control of any third party components.

System and Communications Protection

ScreenPal maintains reasonable security measures to help protect customer information from loss, destruction, misuse, unauthorized access or disclosure. For example, in accordance with applicable law, Personal Data is encrypted in transit (eg TLS1.2 or later) and at rest (eg AES-256).  These security measures can include, but are not limited to, password protection, need-based access, firewall and encryption, employee training, and other such mechanisms. Our security team periodically reviews our information storage and security practices and updates our policies and practices as needed to address changing technologies and known threats.

System and Information Integrity

ScreenPal maintains strict separation of production and non-production environments so that customer data is only stored in a production environment and access to customer data by staff is controlled.  Data destruction follows regulatory requirements and ensures that data is permanently destroyed and not recoverable.  Continuous vulnerability scanning and system monitoring is implemented with appropriate mitigation.

Supply Chain Risk Management

ScreenPal will ensure proper organization and management of information security control measures which are based on information security risks, are in place to address security risk related to organizational sensitive information when shared with a third party or accessed by contractors.  This includes a third party risk  management assessment and annual review.